LoginSign Up
← Back to all sparks
C

Coolify

DEVOPS
Velocity2.5

After four quiet months, Coolify's v4.4 candidate arrives carrying single sign-on.

self-hosted-paasoidc-ssoauthenticationmulti-tenancyrelease-candidateopen-source
◆Current state
Coolify has published the first release candidate for v4.4, its first entry since late April — a four-month gap in a feed that had been running on near-weekly betas. The release is dominated by authentication: first-class OpenID Connect with discovery, JWKS signing-key resolution, token validation, PKCE and identity linking, plus registration-policy controls and an option to auto-join OIDC users to the root team. Team-scoped integration tokens land alongside it, with their own create, edit and permission handling. It is explicitly not for production use.
◆Where it's heading
The earlier beta run was security hardening — team-scoped queries, encrypted webhook secrets, mass-assignment protection, a guard against pruning persistent containers. v4.4 continues that line but changes its character: where the betas were closing holes in a single-team deployment, OIDC and team-scoped integration tokens are the features an organisation requires before it will let a self-hosted PaaS hold its infrastructure. Identity delegated to a corporate provider, and API access scoped per team, are the two things that were missing. The long publishing gap and the jump from a beta.474 numbering to a 4.4 candidate suggest the work was done off the release feed rather than paused.
◆Prediction
The stable v4.4 is the next thing to expect and the release where this work should be judged, since the candidate ships explicitly for testing. Given the OIDC groundwork now includes registration policy and team auto-join, group or role mapping from the identity provider is the natural follow-on once SSO itself settles.

◆Recent moves

  1. 28d ago

    First v4.4 candidate adds first-class OpenID Connect sign-on

    The first v4.4 release candidate, and the first entry in four months, built around first-class OIDC: discovery, JWKS key resolution, token validation, PKCE, identity linking, registration-policy controls, and optional auto-join to the root team. Team-scoped integration tokens arrive with it. This is the enterprise access layer the earlier hardening betas were clearing the ground for, though it ships as a candidate explicitly not for production, so the stable v4.4 is where it counts.

  2. 4mo ago

    Beta 474: data-loss guard for pruned containers, encrypted webhook secrets

    v4.0.0-beta.474 prevents data loss when persistent containers are pruned, encrypts manual webhook secrets, and fixes S3 backup endpoints under the API. The persistent-container fix in particular addresses a long-standing footgun in self-hosted deployments.

  3. 4mo ago

    Beta 474 (duplicate publish)

    Cross-feed duplicate of beta.474 — same release published a few hours apart. No additional content.

    View source ↗
  4. 5mo ago

    Beta 473: upgrade modal + Git source cleanup fixes

    Beta.473 is a small fixup release: upgrade modal showing correct version, safe cleanup of team-owned Git app sources on user deletion. Cleanup work, not new capability.

  5. 5mo ago

    Beta 473 (duplicate publish)

    Cross-feed duplicate of beta.473 from the same day. No additional content.

    View source ↗
  6. 5mo ago

    Beta 471: multi-issue security hardening sweep

    Beta.471 is a broad multi-issue security sweep: mass-assignment hardening, team-scoped queries, locked component properties, Docker network name validation, URL escaping. The volume of changes signals a coordinated audit pass rather than ad-hoc fixes.